Security Medium

Get the report-only CSP ready to enforce, safe directives first

A Content-Security-Policy-Report-Only header is a policy on trial: the browser reports what it would block and blocks nothing. Switching it to enforcing is safe only once those reports have been read, so a policy with no report-uri or report-to has never really been tried. And a policy whose script rules allow 'unsafe-inline' or 'unsafe-eval' would let an injected script run even when enforced. Some directives restrict things an ordinary page never relies on, so they can be enforced today.

Find out whether your site has this problem, and every other check, in one free scan.

Check your site free

Why it matters

A report-only policy stops nothing. Renaming it to an enforcing header is only safe once its violation reports have shown what it would block, and only useful once its script rules no longer allow 'unsafe-inline' or 'unsafe-eval'. A few directives carry no such risk and protect the page today.

How to fix

1 Add a report-to endpoint (with a Reporting-Endpoints header) or report-uri to the report-only policy, if it has none, and watch the reports for a week of real traffic.
2 Enforce the zero-risk directives now, in a separate Content-Security-Policy header: object-src 'none', base-uri 'self', frame-ancestors and form-action.
3 Replace 'unsafe-inline' and 'unsafe-eval' in script-src with nonces or hashes, page by page, while the reports stay clean.
4 Switch the full policy to Content-Security-Policy once the reports show nothing legitimate is blocked.

Common mistakes

Renaming a report-only header that sends its reports nowhere: whatever it would block is discovered by visitors, in production.
Enforcing a policy that still allows 'unsafe-inline' in script-src and counting the job done: an injected inline script runs as before.
Waiting for the whole policy to be perfect before enforcing anything, when object-src 'none', base-uri, frame-ancestors and form-action could protect the page now.

How to verify

1 Inspect the response headers and confirm the report-only policy names a report-to or report-uri endpoint, and that reports arrive there.
2 Confirm an enforcing Content-Security-Policy header now carries object-src 'none', base-uri, frame-ancestors and form-action, and that the site still works.
3 Re-scan: the finding moves to the rename advice once reporting is in place and script-src has no 'unsafe-inline' or 'unsafe-eval'.

Ready to see where you stand?

Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.

Scan your site